A challenge-response authentication and picturized-text recognition method provides protection from sniffer. When a user ask to login, a server generate a string array and a lookup table corresponding to string array and password character. The lookup table is converted to a graph with noise-adding and distorting treatment. The graph is sent to display of user after decryption. The user can input authentication text according to the shown graph and the password thereof. According to another preferred embodiment of the present invention, the graphic data can also be built-in the memory of the server and a graphic data is randomly selected from the database.